Confusing Roles and Groups UX for non-admin users

### Is your feature request related to a problem? Please describe.

This is what non-organisation-admin users see when visiting the Roles page:

This is the case even if the organisation does have custom roles. The message could be interpreted to mean "you (user) do not have any custom roles assigned to you", which can be confusing when troubleshooting permissions during onboarding. Only org admins can view the list of custom roles or perform any actions on them, so there is no reason non-admins should be able to see this page.

When viewing the Groups tab, non-admin users can see all groups in the organisation, even if they don't have admin permissions for them:


Clicking on a group that they are not admins of shows a spinner with no error message:


### Describe the solution you'd like.

* Hide or disable the Roles tab from users who are not organisation admins
* Rename the Roles tab to "Custom Roles", to distinguish them from the built-in roles ("Organisation Admin" and "User")
* Reword the message when no roles exist to "Your organisation does not have any custom roles" or similar
- While we're at it, reword the equivalent message for groups to "Your organisation does not have any groups", for consistency. This is a less redundant wording
* Show an error message if trying to edit a group that a user is not an admin of

Optional - see alternatives below:

* In the Groups tab, visually distinguish somehow which groups a user has permissions to edit or not. Don't allow editing groups that a user is not an admin of

### Describe alternatives you've considered

For groups, it's debatable whether non-admin users should be able to see the full list of groups or not. Within large organisations, admins may want to hide the existence of certain groups from non-admins, either for privacy or to prevent information overload if there is a large amount of groups.

If we do decide to implement this, the Groups page should:

* only list groups that the current user is an admin of, filtering at the API level (all groups for org admins or users with "manage groups" org permisisons; individual groups for group admins)
* show a message like "Your organisation does not have any groups" to org admins or users with "manage groups" org permissions, and "You do not have permissions to manage any groups in your organisation" to others

### Additional context

_No response_